Data Security and Research 101 Completing Required Forms Kimberly Summers, PharmD Assistant Chief for Clinical Research South Texas Veterans Health Care System Research and Development Service (210) x

Goal of VA Privacy and Information Security Protecting the privacy of our veterans Assuring the confidentiality of research subjects’ data Ensuring research will continue within the VA Ensuring the stackholder's and public’s confidence in the integrity of the data

Concerns Regarding VA Research And Cyber-Security Large data sets with PHI & identifiers –VA leads the world in electronic records –VA also receives Medicare Data –Genomic medicine raises new concerns VA investigators have many collaborators Abundance of devices Recent negative publicity regarding loss of VA- sensitive information

VHA Privacy Program Consists of 6 statues that govern collection, maintenance, and release of information –Provision of the Freedom of Information Act, Privacy Act, Title 38 United States Code (U.S.C.) (U.S.C. Sections 5701, 5705, 7332), and Standard of Privacy of Individually-Identifiable Health Information, 45 Code of Federal Regulations (CFR) Parts 160 and 164, hence Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule VHA Handbook addresses most requirements –Investigators must have the authority to collect, use, or disclose private information

Investigator’s Certification: Storage and Security of VA Research Information February 2007 –Deputy Under Secretary for Health Operations and Management and Chief Research and Development Officer established a process by which PIs be certified as meeting the security requirements for VA research information All active protocols had to be certified by ACOS/Research, Information Security Officer (ISO), Privacy Officer, and Director as compliant The STVHCS research program (all protocols) was in jeopardy of being shut down if the entire program didn’t meet the standards

Annual Certification By April 15 of each year –PI must confirm all active research protocols continue to meet the VA data security standards and requirements Process for annual recertification in development Annual security training –Cyber Security, Privacy, and Data Security –Annual certifications are forwarded to the STVHCS Medical Center Director and VISN Director

Collection, Storage, and Use of VA- Sensitive Research Data All protocols submitted for IRB and R&D approval must: –Contain specific information on all sites where data will be used or stored –How data will be transmitted or transported –Who will have access to the data –How data will be secured Information contained in the Data Security Checklist

Completed by R&D office based on information provided by investigator during the pre-review process Returned to PI for signature Reviewed and signed off on by the ACOS/Research and ISO Forwarded to Hospital Director for certification

Information Requested From PI

Background and Definitions Required to Complete VA Research Data Security Checklist

VA-Sensitive Research Data Individually-identifiable research data collected on a veteran subject through a STVHCS approved protocol Individually-identifiable research data collected on a veteran or non-veteran within the STVHCS Individually-identifiable research data collected as part of a VA-funded study

Not VA-Sensitive Data Non-identifiable data Data collected on non-veterans outside of the VA on a non-VA funded project

HIPAA and Research Controls use of protected health information (PHI) –Within the covered entity (STVHCS) –Disclosures outside the covered entity –Allows only the “Minimum Necessary” information Use of PHI requires an authorization or waiver of authorization: –Informed consent / HIPAA authorization from patient –IRB waiver of authorization for exempt research 18 defined “HIPAA identifiers”

HIPAA Identifiers 1. Names 2. ALL geographic subdivisions smaller than the state 3. All elements of dates smaller than a year and all ages over Phone numbers 5. Fax numbers 6. addresses 7. Social Security numbers (SSN) 8. Medical record number 9. Health plan beneficiary numbers 10. Any other account numbers 11. Certificate/license numbers 12. Vehicle identifiers and license plate numbers 13. Device identifiers and serial numbers 14. WEB URL's 15. Internet IP address numbers 16. Biometric identifiers (fingerprint, voice prints, retina scan, etc) 17. Full face photographs or comparable images 18. Any other unique number, characteristic or code

HIPAA Identifiers Continued Any other unique number, characteristic or code –Scrambled SSN –Initials –Last four digits of SSN –Employee numbers –Etc. HIPPA also states that the entity does not have actual knowledge that the remaining information could be used alone or in combination with other information to identify an individual who is the subject of the information

HIPAA and The Common Rule Two different regulations VA requires de-identification by both Common Rule states the identity of the subject can not be readily ascertained by information remaining after removal of all 18 HIPAA identifiers –After stripping all 18 identifiers the remaining information may still be identifiable (e.g. through statistical analysis)

Keys To Coding Systems If non-identifiable information is linked to identifiable information with the use of log (e.g. coding system) –Logs are identifiable and VA-sensitive research data –Applies to data and specimen logs

If There Is No Collection of Identifiable Information Should be consistent with informed consent document and HIPAA authorization Should be consistent with protocol Provide IRB approval letter for exempt research or page(s) of protocol which clearly states no identifiable information will be collected

Disclosure of VA- Sensitive Research Data

Disclosure of Research Data Release, transfer, or provision of access to, or divulging in any other manner information outside the VA VHA Handbook STVHCS is required to maintain an accounting of all disclosures of individually-identifiable information including those for state reporting and research Disclosure of de-identified data, or a limited data set, does not require an accounting

Limited Data Set Data set that contains PHI that excludes 16 categories of direct identifiers May contain identifiable information –Scrambled SSN –City, State, ZIP code –Elements of date and other numbers –Characteristics or codes not listed as direct identifiers

Limited Data Sets: Direct Identifiers 1. Names 2. Postal address other than town, city, state, and ZIP code 3. All elements of dates smaller than a year and all ages over Phone numbers 5. Fax numbers 6. addresses 7. Social Security numbers (SSN) 8. Medical record number 9. Health plan beneficiary numbers 10. Any other account numbers 11. Certificate/license numbers 12. Vehicle identifiers and license plate numbers 13. Device identifiers and serial numbers 14. WEB URL's 15. Internet IP address numbers 16. Biometric identifiers (fingerprint, voice prints, retina scan, etc) 17. Full face photographs or comparable images 18. Any other unique number, characteristic or code

Accounting of Disclosures For VA-Sensitive Research Excluding Limited Data Sets The accounting must include: –Date, nature, and purpose of the disclosure; and –Name and address of the person or agency to whom the disclosure is made Web-based database available –A paper format of the web-based database will be used as a contingency if needed

Privacy Office Review STVHCS Privacy Officer or designee –Provide consultation as needed in the pre- review process –Attends the R&D Committee meetings –Performs a final privacy approval prior to activation of any research protocol Signature required for R&D approval –Monitors the disclosures of private information at least quarterly

STVHCS Privacy Office Contacts Vickie Macdonald, RHIT –(210) Mary Wohl –(210) ext

Storage of VA Research Data

Storage of VA-Sensitive Paper Research Data Lower risk of loss or compromise Physical security controls –Within the VA system Locked room, locked cabinet Access limited to research staff –At the UTHSCSA Physical security arrangements must be inspected and approved by ACOS/Research and ISO

Storage of VA-Sensitive Electronic Research Data Risk of loss or compromise is high Must be stored within the VA system (e.g. behind the VA firewall) –VA research server recommended Accessed directly through the VA network from a VA computer or Through VPN from a non-VA computer –Encrypted VA computer in VA office Rare instances Explain requirement for storage outside the server

VA Research Server For instructions on how to set up an investigator folder on the VA Research server and/or To obtain VPN access –Contact R&D office Angela Casas (210) x15523 –Contact Information Security Officer (ISO) Gerald Steward (210) x14734

Transfer / Transmission of Research Data

Sharing Research Data: Often Appropriate and Necessary With collaborators With those who have specialized expertise With data coordinating centers for Multi-site studies With outside sponsors of research

Transfer or Transmission of Research Data Outside the VA Transfer to entity other than the sponsor or its designated data center –Requires prior written approval from ACOS/Research Privacy Officer Information Security Officer Applies to any VA-sensitive research data –Including limited data-sets Transfer of data should be described in the protocol and consent / HIPAA authorization Transfer or transmission requires an accounting of disclosure

Forms For Authorization of Transfer Data Use Agreement Data Transfer Agreement for within VHA Data Transfer Agreement for outside VHA Removable Storage Media Agreement For assistance obtaining the appropriate forms –Contact R&D office Angela Casas (210) x15523 Forms will be available on STVHCS Research website in future

Loss or Compromise of VA- Sensitive Research Data Must be reported promptly to: –Supervisor –ACOS/Research –Information Security Officer (ISO) –Privacy Officer –IRB Reported as an Unanticipated Problem Involving Risk to Subjects or Others (UPIRSO)

Loss of a Device Used to Transport, Access or Store VA-Sensitive Information Must be reported promptly to: –Supervisor –ISO –If within a VA facility to the VA police If traveling or at another institution report to the security/police officers of the institution and obtain: –Case number –Name and badge number of the investigation officer –Copy of the case report, if possible

Data Security and Research: The Stakes are High VA must assure information security & privacy protects research subjects and facilitates current and future research –May also protect the researcher Negative publicity impacts the local research program and investigators, VA research in general, and VHA health care